Interesting article and perhaps I need to read it closer but generally agree that there’s an inherent tension between the opt-in nature of most privacy-focused projects’ regulatory compliance strategy and the reality that that is almost always insufficient for regulators (no one who would ever opt-in will be people regulators care about for the most part).
1 Like
The basic premise that has not been answered here is who holds the keys?
Ie, do you give those keys to the US, the Chinese, the Russians, the Iranians, the Swiss, or someone else?
If you decide upon the US, then the Chinese won’t like your system and vice-versa. By building keys, that necessarily must be held by someone, you are removing the decentralization aspect of the entire system. If you want this kind of system, you’re probably better of taking an SQL database and lobbying your local government for a new financial system, because the system you’re proposing doesn’t fundamentally look different to the existing financial system.
I agree that not all people care about their privacy, but the truth is there is a small part of people are aware of their privacy problem. We can’t assume that the world is only transparent or private. We want to provide privacy for these people, but at the same time, we don’t want to protect bad actors. We can’t stop them from crime but we must do something after they do it.
We could give these keys to the regulator when they want to do something on our platform, but we will support updating keys as well after they finish it
Fascinating subject, thanks for the thoughts!
Mandatory storage of View Keys by the project or platform leads to the same issues as with Web2, requiring trust in centralized entities.
I disagree. Requiring View Keys does cost some centralization, but only in so-far as Government cooperation is concerned. You can preserve all other decentralization properties while only sacrificing regulatory view access to the transaction. This seems to be close some optimal tradeoff to achieve compliance.
This is the exact entity that it is most important to maintain privacy against in many contexts. If you live in an authoritarian state, you aren’t worried about your family members finding out you have stashed away some money, you are worried about the state finding out you stashed away some money.
1 Like
This is exact entity that it is most important to maintain privacy against in many contexts. If you live in an authoritarian state, you aren’t worried about your family members finding out you have stashed away some money, you are worried about the state finding out you stashed away some money.
Sure. But if you want regulatory cooperation with the lowest overall sacrifice, gated view access seems to be close to the best solution.
This isn’t the lowest sacrifice, it is all of the sacrifice. Might as well stick to non-private chains at that point as they are much easier to build.
1 Like
I understand privacy to mean anonymity and privacy; anonymity is the invisibility of a user’s identity, and privacy is the invisibility of information about the user’s behavior, activities, and other data. “Ola’s solution disrupts the unlinkable attribute of private transactions yet preserves the privacy of each transaction. This allows regulatory bodies to track and freeze target funds based on their linkable attributes alone, without compromising transactional privacy, requiring additional information, or knowing the ownership details of the funds being frozen.” Here’s a paragraph from this article, regulators can track the flow of funds and thus make freezes, etc… Is this tracking only available to the regulator (or the program’s party) or is it available to everyone? Am I to understand that the Ola program addresses anonymity but not privacy?
Everyone has visibility in the system and can trace encrypted data. It’s a decentralized system updating states which of whom any third party can trace.
Sure you can say that it relates to both anonymity and privacy, they are kind of tied together.
Just because you allow for the tracing of encrypted data, you aren’t compromising anonymity nor transactional privacy. Sure, if you have a very short chain of transactions from a user depositing funds into the private tree, and exiting shortly after, you could make an educated guess that this is likely the same person withdrawing their funds after interacting with some application(s), hence, in such a scenario more clearly it’s about anonymity. (On-chain, what would be derived out of that educated guess however, is still the pseudo-anonymous address sending money from the public → private tree).
Privacy of transactional details is fully protected at all times, the burden of proof relies on a third party (regulator) or similarly, to provide evidence of fraudulent inflow of funds / actors to, depending on system design, start DAO votes, ask individual users to share their view keys etc… Or at least being able to follow the flow of funds until it exits the system.
Privacy is normal. It makes much harder for bad actors without compromising users’ privacy.
Important point. Well said. I think KYC also does a significant bit of damage for customers and gives the established participants an unfair position against their customers.
I think your points here are extremely prudent overall. Specifically, there must be legitimate evidence to show financial surveillance has a significant positive impact on crime reduction to allocate resources to further research.
I think the best model to follow is one where governments simply pass regulation establishing blockchain as unregulated. This way there can be a place of open opportunity for developers and builders. I think the main value of blockchain is the decentralized payment mechanisms that allow opportunity for startups and entrepreneurs that don’t exist in the centralized world.
Privacy in the blockchain and cryptocurrency space should be built with a balance between strong individual privacy protection and regulatory compliance. This involves creating privacy solutions that maintain high levels of privacy for users while allowing regulatory bodies to track and prevent malicious activities. Such a privacy approach should:
- Protect user data and transactional privacy.
- Enable regulatory oversight without compromising individual privacy.
- Include mechanisms that allow tracking and freezing target funds based on linkable attributes.
- Maintain a focus on decentralization and data ownership for users.
Crypto can’t be regulated (it’s impossible, because anything regulated would stop being crypto). In the context of cryptocurrencies, privacy can only be unconditional.